Bandit-WalkThrough
免责声明
本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.
https://overthewire.org/wargames/bandit/
Level 0 访问
ssh 连接
主机：bandit.labs.overthewire.org
端口：2220
bandit0/bandit0
不知道为啥 xshell 直接连不上去,用 linux ssh 连接上去了
ssh -p 2220 bandit0@bandit.labs.overthewire.orgLevel 0 → Level 1
连接上后,查看readme
Level 1 → Level 2
通过上一关读出的密码连接 2220 端口的 bandit1 用户
查看当前目录
查看 这个 - 文件,直接看不行,要加个路径
Level 2 → Level 3
通过上一关读出的密码连接 2220 端口的 bandit2 用户
查看当前目录
这个文件名带空格,其实也好解决引号括起来就行了
Level 3 → Level 4
通过上一关读出的密码连接 2220 端口的 bandit3 用户
查看当前目录
带 . 号的文件,默认直接 ls 是看不到的
Level 4 → Level 5
通过上一关读出的密码连接 2220 端口的 bandit4 用户
查看当前目录
题目说是可读类型,用 file 命令查看文件类型
Level 5 → Level 6
通过上一关读出的密码连接 2220 端口的 bandit5 用户
查看当前目录
题目说文件大小是 1033 bytes in size
直接用 find 查找即可
Level 6 → Level 7
通过上一关读出的密码连接 2220 端口的 bandit6 用户
题目里说文件的格式如下
owned by user bandit7
owned by group bandit6
33 bytes in size
一样用find找,不过这里注意将错误输出给 /dev/null
Level 7 → Level 8
通过上一关读出的密码连接 2220 端口的 bandit7 用户
The password for the next level is stored in the file data.txt next to the word millionth
找 data.txt 并匹配 millionth
Level 8 → Level 9
通过上一关读出的密码连接 2220 端口的 bandit8 用户
The password for the next level is stored in the file data.txt and is the only line of text that occurs only once
这里要找文本中只出现一次的行
可以用 uniq 实现
Level 9 → Level 10
通过上一关读出的密码连接 2220 端口的 bandit9 用户
The password for the next level is stored in the file data.txt in one of the few human-readable strings, preceded by several ‘=’ characters.
打开是一堆乱码,尝试用 string 读字符串
Level 10 → Level 11
通过上一关读出的密码连接 2220 端口的 bandit10 用户
The password for the next level is stored in the file data.txt, which contains base64 encoded data
找 base64 数据,解法和上面一样,直接 strings
Level 11 → Level 12
通过上一关读出的密码连接 2220 端口的 bandit11 用户
The password for the next level is stored in the file data.txt, where all lowercase (a-z) and uppercase (A-Z) letters have been rotated by 13 positions
rot13 没啥难度
使用 tr 可以直接转换
Level 12 → Level 13
通过上一关读出的密码连接 2220 端口的 bandit12 用户
The password for the next level is stored in the file data.txt, which is a hexdump of a file that has been repeatedly compressed. For this level it may be useful to create a directory under /tmp in which you can work using mkdir. For example: mkdir /tmp/myname123. Then copy the datafile using cp, and rename it using mv (read the manpages!)
先在tmp创建一个目录然后把根目录下的文件复制过去
用 xxd 命令处理十六进制转储文件
然后就是不停的改后缀,解压
Level 13 → Level 14
通过上一关读出的密码连接 2220 端口的 bandit13 用户
The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Note: localhost is a hostname that refers to the machine you are working on
这里提供私钥,尝试直接使用私钥登录
Level 14 → Level 15
通过上一关读出的密码连接 2220 端口的 bandit14 用户
The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.
Level 15 → Level 16
通过上一关读出的密码连接 2220 端口的 bandit15 用户
The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.
Helpful note: Getting “HEARTBEATING” and “Read R BLOCK”? Use -ign_eof and read the “CONNECTED COMMANDS” section in the manpage. Next to ‘R’ and ‘Q’, the ‘B’ command also works in this version of that command…
这里我们可以通过 openssl 自带的连接工具去连接 30001
Level 16 → Level 17
通过上一关读出的密码连接 2220 端口的 bandit16 用户
The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.
扫描本地端口
一个一个试
返回给我一个私钥文件,尝试另存
当前路径下没有权限,/tmp下也没权限
不如自己创建一个目录
Level 17 → Level 18
这里在上一关的基础上继续做题
There are 2 files in the homedirectory: passwords.old and passwords.new. The password for the next level is in passwords.new and is the only line that has been changed between passwords.old and passwords.new
NOTE: if you have solved this level and see ‘Byebye!’ when trying to log into bandit18, this is related to the next level, bandit19
这里需要比较2个文件的不同行
Level 18 → Level 19
通过上一关读出的密码连接 2220 端口的 bandit18 用户
The password for the next level is stored in a file readme in the homedirectory. Unfortunately, someone has modified .bashrc to log you out when you log in with SSH.
一旦连接之后会自动断开
这里要在登录的时候执行命令
Level 19 → Level 20
通过上一关读出的密码连接 2220 端口的 bandit19 用户
To gain access to the next level, you should use the setuid binary in the homedirectory. Execute it without arguments to find out how to use it. The password for this level can be found in the usual place (/etc/bandit_pass), after you have used the setuid binary.